Who's using all my data allowance?

I keep getting surprise warnings from my ISP about data usage. I generally know what I've been doing but there are a number of other computers, including servers, around the office and it is less easy to keep track of what they are doing.

Can anyone recommend a method of tracking the traffic from each computer so I can keep this under control?

I have a Netgear DG834 V4 if the solution is hardware specific.

Thanks

Edited by deleted (Sat 20-Mar-10 09:22:08)

Have you checked your Security Options?

If you are happy with the maths the DG834 Router Statistics page, gives the average Tx, Rx rate for that session.
This would include all access from all computer devices.

http://www.thinkbroadband.com/tbbmeter
tbbmeter can track usage for all the PC's and aggregate them online, if you are XP, of 32 bit Vista/Windows 7 based then you can get the beta (upon request) which can ignore LAN traffic and only count upload traffic. The beta also has an IP tracking page, so you can assess what site it using all the traffic.

If on 64-bit it will work, but the installer for the latest beta has given people a few issues I need to resolve.

If you have an old network hub, rather than a switch there is a standalone app that can actually monitor all the traffic that goes via a hub (my old DG834v1) actually is a hub, rather than a switch, and this lets me assess the traffic usage from my PS3. http://forums.thinkbroadband.com/tbbmeter/t/3747495-...

This 'snoop' mode is disabled by default on the WAN/LAN beta, but tick Monitor all MAC. If the network is a busy one, best to run that mode on a relatively fast computer.

Andrew

Unfortunately, the majority of my computers run linux so tbbMeter won't help.

Could you elaborate? I'm not sure what security options have to do with it.

Are their any wireless connections which could be leached through?

Have a look at the tools here: http://www.ubuntugeek.com/bandwidth-monitoring-tools...

If you can spare an old machine and add in a second network card, you could use something like
pfSense
or
Smoothwall Express

By setting this computer as your router (with your Netgear just acting as a modem connected via ethernet (PPPoE) then it can monitor traffic without installing anything on each machine.

Smoothwall can give you real-time stats / bandwidth bars per computer on your local network, I suspect pfsense can do similar and is a bit less fussy on hardware support.

Either can also act as a web proxy, can support mulitple internal LANs and a let you apply incoming / outgoing firewall rules. You can also try them out as a virtual machine (preferably on a computer with with multiple network cards).

The software is free / open source and can be downloaded as an ISO so apart from an old PC and possibly a £5 network card the only investment is time.

I'm fairly sure my wi-fi is secure.

Thanks for the links. It looks as if I will have to go down the route of capturing on individual machines. I was hoping for some sort of centralised network monitor but that doesn't look feasible. Theoretically something like wireshark would do it, but the fact that I have a switched network seems to make that impossible.

I suppose you'd need a spare switch as well to make prlzx's solution work (and you'd still need another method of checking wireless traffic).

I only use Wireshark to capture promiscuously which uses an awful lot of storage. You can apply capture filters though. If you haven't used Wireshark from the PC you want to monitor from it's certainly worth trying.

Edited by deleted (Sat 20-Mar-10 14:52:34)

In reply to a post by smitjb:

Can anyone recommend a method of tracking the traffic from each computer so I can keep this under control?

An immediate reaction to this question is to post an answer about the amount of traffic from each computer. But, I think that tracking the sites visited by each computer is a far better option. (Knowing the site, will often mean a good guess can by made about the usage)

Does you router have a Syslog facility which will record all of the outgoing DNS queries? (such as that on DrayTek routers).

I used to monitor my kids activities - I knew exactly which sites they visited and when.